Analysis

  • max time kernel
    150s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-06-2024 03:28

General

  • Target

    cf8d4798baec65113dab7c4b195fff33adc732dba2de9951195bcb06115eb034.exe

  • Size

    66KB

  • MD5

    49fbfdd2a04dbf9c0c4550d0bb4763e3

  • SHA1

    d9d5ed726dd707da03ba6edfb4bd8e73e53599ba

  • SHA256

    cf8d4798baec65113dab7c4b195fff33adc732dba2de9951195bcb06115eb034

  • SHA512

    12dcfce9b2d2fe6d9706d8cf042ef94b5201949314dda266b1dfc9e0f4673431f1757ff3366cb759650fce28e104c3dda7b6ccb2379874f6c58f668b471e3382

  • SSDEEP

    1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXic:IeklMMYJhqezw/pXzH9ic

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cf8d4798baec65113dab7c4b195fff33adc732dba2de9951195bcb06115eb034.exe
    "C:\Users\Admin\AppData\Local\Temp\cf8d4798baec65113dab7c4b195fff33adc732dba2de9951195bcb06115eb034.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1580
    • \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2788
      • \??\c:\windows\system\spoolsv.exe
        c:\windows\system\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:764
        • \??\c:\windows\system\svchost.exe
          c:\windows\system\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3052
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:3704
          • C:\Windows\SysWOW64\at.exe
            at 03:30 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
            5⤵
              PID:3488
            • C:\Windows\SysWOW64\at.exe
              at 03:31 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
              5⤵
                PID:3516
              • C:\Windows\SysWOW64\at.exe
                at 03:32 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                5⤵
                  PID:1864
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4028,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:8
          1⤵
            PID:412

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Roaming\mrsys.exe

            Filesize

            66KB

            MD5

            ddf4433b389973025de3e412b760b81b

            SHA1

            99bb1f0a34b4fc8df1d80097eb430bac4be70a9c

            SHA256

            a607440e6bb516d11c49eb1e3b5f28b32309781e6c3ca65382ff65675b84cbd9

            SHA512

            96f151d736c2d419d4b7e1adc61a62eb6ea5ce04b03dc025a7aba5b4ed8b460d15b8ded3b48c5f78a365a92bec97428a88ed02a0fcae3181ca830883fb36075b

          • C:\Windows\System\explorer.exe

            Filesize

            66KB

            MD5

            00ed6ae2223e51eb6d9fc5c0d8455c5d

            SHA1

            393420230588946e9538431379700f55c379418e

            SHA256

            4b79b89c96f158801fbaad533e80930d3244a9c2820a3c3e94ff74d352412017

            SHA512

            b501a9de506ff0457ab0b3b7ca5cbc5d3f7e6ca178ebe087e98780597a379df28bf901998812bba9a7d4af62905ecfaee2f884b1b36df4ba75ad6a59b8048af2

          • C:\Windows\System\spoolsv.exe

            Filesize

            66KB

            MD5

            53db99230e51066681f2344d9bc8e76f

            SHA1

            c4b02472c8b76565ad4bf9317859892fc537df5d

            SHA256

            cc66bdad88b36eaf5b89fb6a57a23261bd009ddb5121e6b9972692203afaabfb

            SHA512

            c1f9d2eece1a63c11850b48a3b84649b704e38d193044392b6aecee9259f6f6c946f6054eb11186655830979d9295ad11df4b520139bc20b6084d489f42b236e

          • C:\Windows\System\svchost.exe

            Filesize

            66KB

            MD5

            8b05219e34e432054b9a68a4c90fc145

            SHA1

            f3248725de1176b9ce4ab02fd0cbd6a31900df7f

            SHA256

            995e701f5c5714433d3975add56aca268290bacb59d4fcc179ce61559398d43c

            SHA512

            204e68712829704dff97e53e89692f53758d1669863d8b825d727294dc47508a13840da484a20d783da724a183f2c9871dea897faf0254a2eef43ddb94ecfc64

          • memory/764-54-0x0000000000400000-0x0000000000431000-memory.dmp

            Filesize

            196KB

          • memory/764-28-0x0000000000400000-0x0000000000431000-memory.dmp

            Filesize

            196KB

          • memory/764-25-0x0000000075170000-0x00000000752CD000-memory.dmp

            Filesize

            1.4MB

          • memory/1580-3-0x0000000000400000-0x0000000000431000-memory.dmp

            Filesize

            196KB

          • memory/1580-4-0x0000000000401000-0x000000000042E000-memory.dmp

            Filesize

            180KB

          • memory/1580-2-0x0000000075170000-0x00000000752CD000-memory.dmp

            Filesize

            1.4MB

          • memory/1580-1-0x00000000001C0000-0x00000000001C4000-memory.dmp

            Filesize

            16KB

          • memory/1580-43-0x00000000001C0000-0x00000000001C4000-memory.dmp

            Filesize

            16KB

          • memory/1580-0-0x0000000000400000-0x0000000000431000-memory.dmp

            Filesize

            196KB

          • memory/1580-56-0x0000000000400000-0x0000000000431000-memory.dmp

            Filesize

            196KB

          • memory/1580-57-0x0000000000401000-0x000000000042E000-memory.dmp

            Filesize

            180KB

          • memory/2788-13-0x0000000000400000-0x0000000000431000-memory.dmp

            Filesize

            196KB

          • memory/2788-14-0x0000000075170000-0x00000000752CD000-memory.dmp

            Filesize

            1.4MB

          • memory/2788-18-0x0000000000400000-0x0000000000431000-memory.dmp

            Filesize

            196KB

          • memory/2788-70-0x0000000000400000-0x0000000000431000-memory.dmp

            Filesize

            196KB

          • memory/2788-59-0x0000000000400000-0x0000000000431000-memory.dmp

            Filesize

            196KB

          • memory/3052-36-0x0000000075170000-0x00000000752CD000-memory.dmp

            Filesize

            1.4MB

          • memory/3052-61-0x0000000000400000-0x0000000000431000-memory.dmp

            Filesize

            196KB

          • memory/3052-40-0x0000000000400000-0x0000000000431000-memory.dmp

            Filesize

            196KB

          • memory/3704-52-0x0000000000400000-0x0000000000431000-memory.dmp

            Filesize

            196KB

          • memory/3704-44-0x0000000075170000-0x00000000752CD000-memory.dmp

            Filesize

            1.4MB